13

I am trying to create a web app that is using a two-factor authenticator using the google authenticator, so my question is, is there an api for google authenticator?

Jama Mohamed
  • 2,239
  • 4
  • 22
  • 36
  • Possible duplicate of [Google Authenticator available as a public service?](https://stackoverflow.com/questions/5087005/google-authenticator-available-as-a-public-service) – Stoogy Nov 21 '18 at 13:51

2 Answers2

12

There are plenty of examples of how to create your own client for Google Authenticator, however, you can also use an API, which may be easier.

Firstly, you create a QR code to pair with, combined with your app description, and a secret code as follows;

https://www.authenticatorApi.com/pair.aspx?AppName=MyApp&AppInfo=John&SecretCode=12345678BXYT

Then, once the user has paired, you can validate their PIN using the validate API call;

https://www.authenticatorApi.com/Validate.aspx?Pin=123456&SecretCode=12345678BXYT

The source code for this API is available as open source on GitHub here; https://github.com/infiniteloopltd/AuthenticatorAPI.com

Fiach Reid
  • 4,811
  • 2
  • 27
  • 33
  • 8
    Please be aware that if you choose to use such an API you are leaking your 2FA credentials in an incredibly insecure way. Instead use libraries for your language of choice. – WouterH Jun 03 '21 at 13:50
1

Yes, a quick go-through:

  1. Your users download Google Authenticator app https://apps.apple.com/us/app/google-authenticator/id388497605 or https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en&gl=US

  2. You generate a "secret" code on behalf of your user:

    https://google-authenticator.p.rapidapi.com/new/

    Server will return you the secret code (e.g. "GXPTBCTI4DX4UFJB"), keep the code, because you'll need it at steps 3 and 4.

  3. You generate QR codes for your users via:

    https://google-authenticator.p.rapidapi.com/enroll/?secret=GXPTBCTI4DX4UFJB&account=JohnDoe&issuer=AcmeCorp

    Users scan the QR code using Google Authenticator app and temporary codes now get generated.

  4. Now you can validate the codes via:

    https://google-authenticator.p.rapidapi.com/validate/?code=266677&secret=GXPTBCTI4DX4UFJB

See full tutorial here https://rapidapi.com/chdan/api/google-authenticator/tutorials/easy-two-factor-authentication-(2fa)-with-google-authenticator.

Hope this helps.

Daniil Penegin
  • 21
  • 2